# Reserves can be stolen by settling artificially created bad debt from them

Attacker inflates LUP via a high bucket, pulls nearly all collateral from own loan, kicks it, then settles artificial bad debt from pool reserves.

- Payout: Contest reward
- Severity: high
- Program: Ajna
- Credited: hyh
- Disclosed: 2023-09-26
- Write-up quality: 8/10
- Original: https://github.com/sherlock-audit/2023-09-ajna-judging/issues/71
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-09-ajna%3AH-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:chained vuln:accounting-error vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** ERC20 lending pool (BorrowerActions/LenderActions/SettlerActions)
**Root cause:** LUP is the only guard on collateral removal and is computed just-in-time, so a self-funded ultra-high bucket inflates LUP and lets the borrower pull almost all collateral; the resulting bad debt is then settled from pool reserves.
**Steps:**
1. Open manipulated_loan (ML) at TP just below LUP with ~150 quote worth of collateral.
2. Add quote funds equal to total utilized deposits (200) into an ultra_high_bucket (UHB) far above market price.
3. Remove collateral from ML up to the elevated LUP (UHB price), leaving ~10 quote worth.
4. Lender kicks ML (removing UHB funds pushes LUP down, enabling kick), reviving HTP.
5. Remove all from UHB except quote frozen by the auction (leave 100). Steps 1-5 atomic.
6. Wait for auction price to reach UHB price, call `takeBucket` with `depositTake == true`; ~98.482 quote covers debt, 1.518 is kicker reward.
7. Call `settlePoolDebt()` to settle remaining 1.518 debt from pool reserves.
8. Remove all UHB funds with initial and awarded LP shares, netting 1.518 quote profit. Steps 6-8 atomic.
**How found:** Code reading of BorrowerActions pull path showing LUP as sole collateral guard, combined with LenderActions removeQuoteToken HTP check and SettlerActions reserve settlement logic; recognized that a self-controlled high bucket could inflate LUP just-in-time and that kicker/borrower/lender roles could be one actor.
**Exploitation:** Attacker controls lender, borrower and kicker (same contract address allowed). Funds UHB with flash-loaned quote (Ajna flashloans are free), inflates LUP, strips collateral, kicks own loan, then takeBucket + settlePoolDebt to convert reserves into profit; repeat across pools.
**Escalation:** Repeatable and parallelizable across all pools/chains to fully drain reserves, which also removes bad-debt coverage and can render pools insolvent.
**Insight:** When a lending protocol computes a just-in-time price (LUP) as the only collateral-withdrawal guard, check whether an attacker can self-fund a deposit bucket to move that price, then use the kicker/settlement path to convert the resulting bad debt into reserve funds.